本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。
# AWSElasticDisasterRecoveryServiceRolePolicy
**描述**：此政策允許 Elastic Disaster Recovery 代表您管理 AWS 資源。
`AWSElasticDisasterRecoveryServiceRolePolicy` 是 [AWS 受管政策](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)。
## 使用此政策
此政策會連接到服務連結角色，讓服務代表您執行動作。您無法將此政策連接至使用者、群組或角色。
## 政策詳細資訊
+ **類型**：服務連結角色政策
+ **建立時間**：2021 年 11 月 17 日 10：56 UTC
+ **編輯時間：**2025 年 1 月 5 日 14：07 UTC
+ **ARN**: `arn:aws:iam::aws:policy/aws-service-role/AWSElasticDisasterRecoveryServiceRolePolicy`
## 政策版本
**政策版本：** v8 （預設）
政策的預設版本是定義政策許可的版本。當具有 政策的使用者或角色提出存取 AWS 資源的請求時， 會 AWS 檢查政策的預設版本，以決定是否允許請求。
## JSON 政策文件
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "DRSServiceRolePolicy1",
"Effect" : "Allow",
"Action" : [
"drs:ListTagsForResource"
],
"Resource" : "*"
},
{
"Sid" : "DRSServiceRolePolicy2",
"Effect" : "Allow",
"Action" : [
"drs:TagResource"
],
"Resource" : "arn:aws:drs:*:*:recovery-instance/*"
},
{
"Sid" : "DRSServiceRolePolicy3",
"Effect" : "Allow",
"Action" : [
"drs:CreateRecoveryInstanceForDrs",
"drs:TagResource"
],
"Resource" : "arn:aws:drs:*:*:source-server/*"
},
{
"Sid" : "DRSServiceRolePolicy4",
"Effect" : "Allow",
"Action" : "iam:GetInstanceProfile",
"Resource" : "*"
},
{
"Sid" : "DRSServiceRolePolicy5",
"Effect" : "Allow",
"Action" : "kms:ListRetirableGrants",
"Resource" : "*"
},
{
"Sid" : "DRSServiceRolePolicy6",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeImages",
"ec2:DescribeInstances",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceStatus",
"ec2:DescribeLaunchTemplateVersions",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeVolumes",
"ec2:DescribeVolumeAttribute",
"ec2:GetEbsDefaultKmsKeyId",
"ec2:GetEbsEncryptionByDefault",
"ec2:DescribeVpcAttribute",
"ec2:DescribeInternetGateways",
"ec2:DescribeVpcs",
"ec2:DescribeNetworkAcls",
"ec2:DescribeRouteTables",
"ec2:DescribeDhcpOptions",
"ec2:DescribeManagedPrefixLists",
"ec2:GetManagedPrefixListEntries",
"ec2:GetManagedPrefixListAssociations",
"ec2:DescribeNetworkInterfaces"
],
"Resource" : "*"
},
{
"Sid" : "DRSServiceRolePolicy7",
"Effect" : "Allow",
"Action" : [
"ec2:RegisterImage"
],
"Resource" : "*"
},
{
"Sid" : "DRSServiceRolePolicy8",
"Effect" : "Allow",
"Action" : [
"ec2:DeregisterImage"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy9",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteSnapshot"
],
"Resource" : "arn:aws:ec2:*:*:snapshot/*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy10",
"Effect" : "Allow",
"Action" : [
"ec2:CreateLaunchTemplateVersion",
"ec2:ModifyLaunchTemplate",
"ec2:DeleteLaunchTemplate",
"ec2:DeleteLaunchTemplateVersions"
],
"Resource" : "arn:aws:ec2:*:*:launch-template/*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy11",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteVolume",
"ec2:ModifyVolume"
],
"Resource" : "arn:aws:ec2:*:*:volume/*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy12",
"Effect" : "Allow",
"Action" : [
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:TerminateInstances",
"ec2:ModifyInstanceAttribute",
"ec2:GetConsoleOutput",
"ec2:GetConsoleScreenshot"
],
"Resource" : "arn:aws:ec2:*:*:instance/*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy13",
"Effect" : "Allow",
"Action" : [
"ec2:RevokeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress"
],
"Resource" : "arn:aws:ec2:*:*:security-group/*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy14",
"Effect" : "Allow",
"Action" : [
"ec2:CreateVolume"
],
"Resource" : "arn:aws:ec2:*:*:volume/*",
"Condition" : {
"Null" : {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy15",
"Effect" : "Allow",
"Action" : [
"ec2:CreateSecurityGroup"
],
"Resource" : "arn:aws:ec2:*:*:security-group/*",
"Condition" : {
"Null" : {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy16",
"Effect" : "Allow",
"Action" : [
"ec2:CreateSecurityGroup"
],
"Resource" : "arn:aws:ec2:*:*:vpc/*"
},
{
"Sid" : "DRSServiceRolePolicy17",
"Effect" : "Allow",
"Action" : [
"ec2:CreateLaunchTemplate"
],
"Resource" : "arn:aws:ec2:*:*:launch-template/*",
"Condition" : {
"Null" : {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy18",
"Effect" : "Allow",
"Action" : [
"ec2:CreateSnapshot"
],
"Resource" : "arn:aws:ec2:*:*:volume/*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy19",
"Effect" : "Allow",
"Action" : [
"ec2:CreateSnapshot"
],
"Resource" : "arn:aws:ec2:*:*:snapshot/*",
"Condition" : {
"Null" : {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy20",
"Effect" : "Allow",
"Action" : [
"ec2:DetachVolume",
"ec2:AttachVolume"
],
"Resource" : "arn:aws:ec2:*:*:instance/*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy21",
"Effect" : "Allow",
"Action" : [
"ec2:AttachVolume"
],
"Resource" : "arn:aws:ec2:*:*:volume/*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy22",
"Effect" : "Allow",
"Action" : [
"ec2:DetachVolume"
],
"Resource" : "arn:aws:ec2:*:*:volume/*"
},
{
"Sid" : "DRSServiceRolePolicy23",
"Effect" : "Allow",
"Action" : [
"ec2:RunInstances"
],
"Resource" : "arn:aws:ec2:*:*:instance/*",
"Condition" : {
"Null" : {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy24",
"Effect" : "Allow",
"Action" : [
"ec2:RunInstances"
],
"Resource" : [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:image/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:launch-template/*"
]
},
{
"Sid" : "DRSServiceRolePolicy25",
"Effect" : "Allow",
"Action" : "iam:PassRole",
"Resource" : [
"arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryReplicationServerRole",
"arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole",
"arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : "ec2.amazonaws.com"
}
}
},
{
"Sid" : "DRSServiceRolePolicy26",
"Effect" : "Allow",
"Action" : "ec2:CreateTags",
"Resource" : [
"arn:aws:ec2:*:*:launch-template/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition" : {
"StringEquals" : {
"ec2:CreateAction" : [
"CreateLaunchTemplate",
"CreateSecurityGroup",
"CreateVolume",
"CreateSnapshot",
"RunInstances",
"CreateNetworkInterface"
]
}
}
},
{
"Sid" : "DRSServiceRolePolicy27",
"Effect" : "Allow",
"Action" : "ec2:CreateTags",
"Resource" : [
"arn:aws:ec2:*:*:image/*"
],
"Condition" : {
"Null" : {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy28",
"Effect" : "Allow",
"Action" : "cloudwatch:GetMetricData",
"Resource" : "*"
},
{
"Sid" : "DRSServiceRolePolicy29",
"Effect" : "Allow",
"Action" : [
"ec2:CreateVolume"
],
"Resource" : "arn:aws:ec2:*:*:snapshot/*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy30",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkInterface"
],
"Resource" : "arn:aws:ec2:*:*:network-interface/*",
"Condition" : {
"Null" : {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy31",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkInterface"
],
"Resource" : [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*"
]
},
{
"Sid" : "DRSServiceRolePolicy32",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkInterfacePermission",
"ec2:DeleteNetworkInterface",
"ec2:ModifyNetworkInterfaceAttribute"
],
"Resource" : "arn:aws:ec2:*:*:network-interface/*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged" : "false"
}
}
},
{
"Sid" : "DRSServiceRolePolicy33",
"Effect" : "Allow",
"Action" : [
"ec2:ModifyNetworkInterfaceAttribute"
],
"Resource" : [
"arn:aws:ec2:*:*:instance/*"
]
}
]
}
```
## 進一步了解
+ [了解 IAM 政策的版本控制](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [開始使用 AWS 受管政策並邁向最低權限許可](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)